Regular Expressions Examples

[#1]

I thought it might be a good idea to start a thread where we can all post examples of Regular Expressions that we use to block spam. Or maybe some good web sites that we use to look up expressions. This is to help users who aren' t familiar with Regex (like I was when I first got my FG) to get them started and perhaps for all of us to find better expressions to use to keep spam to a minimum. Perhaps if this thread is useful it could be stickied to make it easier to find...

[abelio]

Hi laf,

still I don' t get this line: set pattern " /\\b0FF\\b/"

actually there' s an error in my first post (25-11-09) because the ' entries' definition is missing; repost from feb-19 has the correct syntax; Anyway: the issue could be triggered for the difference about how treat webGUI or CLI the regexp syntax. . you want to match 0FF string (a zero plus 2 uppercase F), so you use anchor \b to define boundaries; (to avoid to match C0FFEE for instance) . as \b is special, you need to escape it with another slash, so \\b0FF\\b . As you know, if you use regular expressions, is standard practice use delimiters to catch the pattern, i.e. /pattern/ or |pattern| or m{pattern}; webGUI it' s no strict to manage pattern, so you could keep \\b0FF\\b and within CLI you' ll see set pattern " \\b0FF\\b" If you want your regexp case insensitive, the // are now mandatory and the syntax would be set pattern " /\\b0FF\\b/i" ; but if not, above regexp should works Sorry by the typos and lack of precission in earlier posts. regards

[laf]

our regexp case insensitive, the // are now mandatory and the syntax would be set pattern " /

Thank you sir!

[#4]

I have recently learned more about regexs and have fixed all of the entries I had posted earlier to make them work better. In many of my examples I had posted entries containing badly formatted examples (like [1|!|a]). When using squared brackets the system looks for any letter that is within the brackets so the pipes are not necessary. Also, I had been doing [com|ca|org] thinking that I was chacking for a domain suffix when in fact we are looking for any of those letters. The correct way to look for groupings is (com|ca|org). As discussed before, \b looks for a non alphanumeric item (such as a space, period, comma, etc). It also seems to work with carriage returns so even if the word is the first word in the body or subject it is still detected when a \b is at the front of the regex. Wrapping single word entries in \b prevents things like the system detecing the sex in sexton, or the cum in cummings (that' s one I ran into), etc. So some of my revised entries look like this: /\bc[i1][a4@][il1!][il1!][sz]\b/i -> cialis, c1@lis, etc /\br[o0][l1!][e3]x\b/i -> rolex, r0lex, etc /\bunsubscr[i1!]b[e3]\b/i -> unsubscribe, unsubscr1be, etc /i am( so)? lonely/i /(setting|settings|setup)\.(zip|rar|exe)/i This should help some who are just starting with regex. The last one is intended to check for links within the body, not an attachment.

[rwpatterson]

FYI ' \b' is border. Anything that separates alphanumeric from white space and/or punctuation, carriage return, etc.

[#6]

Okay, how do I block everything? A blank regular expression and/or wildcard?

[abelio]

ORIGINAL: taylork Okay, how do I block everything?

try with this regexp: ^.*$

[#8]

I see someone here mentioned using sender=recipient as a filter. How would one apply that so that it blocks some of the spoofed email. Nearly 80% of our spam comes in spoofed in this condition. Thanks in advance.

[#9]

I would like to blacklist any email address NOT from .com, .net, .org, .edu, .gov or .mil. So, what is the OPPOSITE of this regular expression?... /^[^ ]+@[^ ]\.(com|net|org|edu|gov|mil)$/i Thank you for your help!

[rwpatterson]

Welcome to the forums. Would be easier to whitelist those extension, then next line block everything.